PassCheck

The problem

I wanted a simple way to check if a password had been found in a breach, and if it wasn't found in any breach, to know how strong the password was.

What I did

I used the Have I Been Pwned API to check for breaches. I hashed the password before sending anything, partly because the API expects it, partly because it's just good practice not to send raw passwords anywhere.

I only send the first 5 characters of the hash, that's k-anonymity. The API returns every hash starting with that prefix, and I match locally. The full password never goes outside my system.

For strength scoring, I started with simple heuristics, assigning points for uppercase, lowercase, digits, symbols. Then, mostly to learn something new, I scraped 3,000 passwords, engineered features like length and character-type counts, and trained a RandomForest model on them. Looking back, it was overkill for this problem, since the heuristic score and the model's score were quite near most of the time.

For generating a stronger password, I used Python's secrets module instead of random, since random isn't cryptographically safe.

Architecture

flowchart TD
    CLI["CLI (passcheck.py)"]
    CH["checker.py<br/>HIBP breach check"]
    SC["scorer.py<br/>ML + fallback"]
    GEN["generator.py"]
    ML["ML pipeline<br/>(training/*)"]

    CLI --> CH
    CLI --> SC
    CLI --> GEN
    SC --> ML

A CLI with three parts: checker.py for HIBP breach checks, scorer.py for the ML score with a heuristic fallback, and generator.py. Plus an ML pipeline under training/.

What came of it

It works end to end: breach check, strength score, password suggestion, all in one CLI. It's on PyPI now too.

Next time

Before integrating ML, I'd actually verify the problem needs it instead of directly jumping to integrate it into the project.